clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/portal-ui/dist/index.html

@@ -49,8 +49,8 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-5UyqAyNM.js"></script>
-    <link rel="stylesheet" crossorigin href="/portal/assets/index-CVOIvdhc.css">
+    <script type="module" crossorigin src="/portal/assets/index-EVaSo5-g.js"></script>
+    <link rel="stylesheet" crossorigin href="/portal/assets/index-CtvwLCti.css">
   </head>
   <body>
     <div id="root"></div>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.7",
+  "version": "0.3.2-beta.9",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/README.md

@@ -141,7 +141,7 @@ Case-law setup is an OAuth flow, **not** an environment variable — see
 
 ## Adding or changing a register adapter
 
-Read [`../driver/skills/prelim-register/providers/README.md`](../driver/skills/prelim-register/providers/README.md)
+Read [`../driver/skills/clearance-register/providers/README.md`](../driver/skills/clearance-register/providers/README.md)
 first — it carries the mandatory empirical-verification checklist. The short version: **never inherit a
 capability claim by analogy from another provider.** Every operator, filter, pagination shape and
 composition rule is probed against the live API before it is written down, and the observed figure is

package/providers/_shared/enumerate.mjs

@@ -60,8 +60,8 @@ import { clipProviderText } from "./provider-text.mjs";   // — keep the discri
 
 // ── — HOW MUCH OF A PROVIDER ERROR SURVIVES INTO THE BAND BLOCK ───────────────────────────────
 //
-// Both were 140, and 140 is where the defect lived: the Clarivate Near/Adj refusal is 144 characters
-// and its verdict — `are not allowed` — is the last two words. Cut at 140 it arrived as `are not all`,
+// Both were 140, and 140 is where the defect lived: one register's Near/Adj refusal runs just past that
+// bound and its verdict — `are not allowed` — is the last two words. Cut at 140 it arrived truncated,
 // That structural predicate could not match, and a refusal that recurs byte-identically forever was
 // filed as weather and retried on every future run of that shape.
 //
@@ -299,9 +299,9 @@ export function makeEnumerate(deps) {
   }
 
   // ── count-first per-CLASS rescue ──────────────────────────────────────────────────────────────────
-  // The per-term rescue's exact sibling, on the OTHER axis a stack can crowd along. A multi-class
-  // owner query [cl 5,29,30,32,33,35,43] came back 805 > 600 and shipped as one blind count — "Cl. 30
-  // leg unopened" became the whole of the residual risk story — when per-class counts would have made
+  // The per-term rescue's exact sibling, on the OTHER axis a stack can crowd along. A multi-class owner
+  // query crowded over the ceiling and shipped as one blind count — a single unopened class leg became
+  // the whole of the residual risk story — when per-class counts would have made
   // EVERY leg individually enumerable. So: an OWNER-SCOPED query (a bare-owner sweep or an owner×term
   // slice — the only shapes whose crowds are portfolio-shaped rather than name-shaped) that crowds over
   // the ceiling across >1 class is counted per class with the SAME shared count kernel, and every
@@ -371,7 +371,7 @@ export function makeEnumerate(deps) {
     // A provider with no total anywhere cannot run a count-first rescue — there is nothing to count.
     const countFirst = countProbe !== "none";
     // The per-class rescue's trigger shape: an owner-scoped query (bare-owner sweep or owner×term
-    // slice) spanning >1 class — the portfolio-shaped crowd the 805 count died as. The per-term rescue
+    // slice) spanning >1 class — the portfolio-shaped crowd a single blind count dies as. The per-term rescue
     // keeps precedence on multi-name stacks (its accounting is the finer truth there).
     const ownerScoped = isOwnerScoped(params);
     const splitClasses = ownerScoped

package/providers/_shared/execute-plan.mjs

@@ -172,9 +172,9 @@ export const unresolvedOwnerCountReason = (term, coveredBy) =>
  *
  * WHAT IT NO LONGER CLAIMS. It used to say "this owner is answered record-by-record by the owner×term
  * slice(s) …". `covered_by` is stamped at PLAN COMPILE time and names the slices that were DICTATED for
- * this owner — it says nothing about whether they enumerated. Measured across a delivered round: true
- * for 4 of 14 owners and false for 10, covering 39,302 hits (31% of the untraced total). The descriptor
- * was asserting coverage it is not in a position to observe, on the largest class in the artifact.
+ * this owner — it says nothing about whether they enumerated. Measured across a delivered round, it was
+ * true for a minority of owners and false for the rest, and the hits it covered were the largest single
+ * class in the artifact. The descriptor was asserting coverage it is not in a position to observe.
  *
  * The pointer is the part worth keeping, so it stays and the CLAIM around it goes: these are where the
  * records were sought, and their own state is what says whether they were found. PURE.

package/providers/_shared/ledger.mjs

@@ -29,9 +29,10 @@
 //
 // Telemetry is fully isolated in try/catch: a ledger failure must NEVER affect a search.
 
-import { appendFileSync, mkdirSync } from "node:fs";
-import { dirname } from "node:path";
-import { ledgerPath } from "./ledger-path.mjs";
+import { appendFileSync, mkdirSync, statSync, openSync, readSync, closeSync, readFileSync, writeFileSync, renameSync, rmdirSync } from "node:fs";
+import { dirname, basename } from "node:path";
+import { createHash } from "node:crypto";
+import { ledgerPath, RUN_RECORD_LOG_FILE } from "./ledger-path.mjs";
 
 export const CALL_LOG_PATH = ledgerPath("call");
 // Spec A1 (citation fidelity): every fetched record's BODY is persisted alongside the call ledger, so the
@@ -97,7 +98,7 @@ export function makeLedger(provider) {
       // written into the row.
       const dest = typeof tctx?.recordLog === "string" && tctx.recordLog.trim()
         ? tctx.recordLog.trim() : RECORD_LOG_PATH;
-      append(dest, JSON.stringify({
+      const row = {
         ts: new Date().toISOString(),
         provider,
         agentId:    tctx?.agentId    ?? null,
@@ -105,8 +106,121 @@ export function makeLedger(provider) {
         sessionId:  tctx?.sessionId  ?? null,
         target,
         body,
-      }));
+      };
+      if (basename(dest) === RUN_RECORD_LOG_FILE) writeRecordOnce(dest, row);
+      else append(dest, JSON.stringify(row));
     } catch { /* record persistence must never break a search */ }
   };
   return { logCall, logRecordBody, tctxOf };
 }
+
+// ── EACH REGISTER RECORD ONCE PER RUN ─────────────────────────────────────────────────────────────────
+//
+// A record that several queries return — an OR-list, a compound, the mark itself — was appended once per
+// query. Measured on a delivered four-letter run: 2,898 lines for 2,098 distinct records, 800 of them a
+// record already in the file, 21.6 MB of a 106 MB ledger, and the band server reads the whole file on a
+// cache miss. 786 of the 800 were byte-identical bodies.
+//
+// So a body for a record already written is not appended. A body that DIFFERS from the one written (a
+// status moved between two queries) replaces it ONCE, in place, and the replacement says so: `refreshed:
+// true` and the timestamp of the body it replaced. Once only, so a field that varies between answers
+// cannot rewrite the file on every query. Every field stays, the vendor's raw copy included.
+//
+// SEVERAL PROCESSES WRITE ONE RUN'S LEDGER — the register servers of parallel stages and the driver's own
+// fetches — so "already written" is read off the FILE, never off this process's memory alone: each write
+// indexes whatever was appended since this process last looked. Writes take a lock directory beside the
+// file, so an in-place replacement (written to a temporary file and renamed over, which readers see
+// atomically) cannot drop a line another process was appending. A lock that cannot be had in time falls
+// back to a plain append: a duplicate line is the old behaviour, a lost record is not acceptable.
+//
+// Run-scoped ledgers only. The box-wide fallback file holds many runs, and a record one run fetched is not
+// a record another run holds.
+const RUN_INDEXES = new Map();   // dest → { offset, byTarget: Map<key, { hash, refreshed, ts }> }
+const targetKey = (t) => String(t ?? "").toLowerCase();   // the key every reader of this file matches on
+const bodyHash = (b) => createHash("sha1").update(JSON.stringify(b ?? null)).digest("hex");
+
+function indexRow(ix, line) {
+  if (!line.trim()) return;
+  try {
+    const r = JSON.parse(line);
+    ix.byTarget.set(targetKey(r?.target), { hash: bodyHash(r?.body), refreshed: r?.refreshed === true, ts: r?.ts ?? null });
+  } catch { /* a torn or foreign line indexes nothing, and is left where it is */ }
+}
+
+/** Index every whole line appended since this process last looked; a file that shrank is re-read. */
+function indexOf(dest) {
+  let size = 0, ino = null;
+  try { const st = statSync(dest); size = st.size; ino = st.ino; } catch { size = 0; }
+  let ix = RUN_INDEXES.get(dest);
+  // A replacement elsewhere renames a NEW file over this one: same path, different inode, and an offset
+  // into the old file means nothing in the new one. Re-read from the start.
+  if (!ix || size < ix.offset || ix.ino !== ino) { ix = { offset: 0, ino, byTarget: new Map() }; RUN_INDEXES.set(dest, ix); }
+  if (size <= ix.offset) return ix;
+  const fd = openSync(dest, "r");
+  try {
+    const CHUNK = 8 * 1024 * 1024;
+    let carry = Buffer.alloc(0);
+    let pos = ix.offset;
+    while (pos < size) {
+      const buf = Buffer.alloc(Math.min(CHUNK, size - pos));
+      const n = readSync(fd, buf, 0, buf.length, pos);
+      if (n <= 0) break;
+      pos += n;
+      const data = carry.length ? Buffer.concat([carry, buf.subarray(0, n)]) : buf.subarray(0, n);
+      const last = data.lastIndexOf(0x0a);
+      if (last < 0) { carry = data; continue; }
+      for (const line of data.subarray(0, last).toString("utf8").split("\n")) indexRow(ix, line);
+      carry = data.subarray(last + 1);   // a line still being written waits for the next look
+      ix.offset = pos - carry.length;
+    }
+  } finally { closeSync(fd); }
+  return ix;
+}
+
+const sleepMs = (ms) => { try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); } catch { /* no sleep available */ } };
+
+/** Run `fn` holding the ledger's lock; false (and `fn` not run) when the lock could not be had in time. */
+function withLedgerLock(dest, fn) {
+  const lock = `${dest}.lock`;
+  const deadline = Date.now() + 3000;
+  for (;;) {
+    try { mkdirSync(dirname(dest), { recursive: true }); mkdirSync(lock); break; }
+    catch {
+      // A holder that died leaves the directory behind; nothing holds this lock for more than a rewrite.
+      try { if (Date.now() - statSync(lock).mtimeMs > 30_000) { rmdirSync(lock); continue; } } catch { continue; }
+      if (Date.now() > deadline) return false;
+      sleepMs(10);
+    }
+  }
+  try { fn(); } finally { try { rmdirSync(lock); } catch { /* already gone */ } }
+  return true;
+}
+
+function writeRecordOnce(dest, row) {
+  const done = withLedgerLock(dest, () => {
+    const ix = indexOf(dest);
+    const key = targetKey(row.target);
+    const hash = bodyHash(row.body);
+    const prev = ix.byTarget.get(key);
+    if (prev && (prev.hash === hash || prev.refreshed)) return;          // written already; replaced at most once
+    if (!prev) {
+      append(dest, JSON.stringify(row));
+      indexOf(dest);
+      return;
+    }
+    // A CHANGED BODY REPLACES THE ONE WRITTEN, in place, recorded as such. Written whole to a temporary
+    // file and renamed over, so a reader sees the old file or the new one and never half of either.
+    const next = { ...row, refreshed: true, refreshed_from: prev.ts ?? null };
+    const kept = readFileSync(dest, "utf8").split("\n").filter((line) => {
+      if (!line.trim()) return false;
+      try { return targetKey(JSON.parse(line)?.target) !== key; } catch { return true; }
+    });
+    kept.push(JSON.stringify(next));
+    const tmp = `${dest}.${process.pid}.tmp`;
+    writeFileSync(tmp, kept.join("\n") + "\n");
+    renameSync(tmp, dest);
+    RUN_INDEXES.delete(dest);
+    indexOf(dest);
+  });
+  if (!done) append(dest, JSON.stringify(row));
+}

package/providers/_shared/provider-text.mjs

@@ -18,8 +18,8 @@
 // ── WHY TAIL-PRESERVING, RATHER THAN A BIGGER NUMBER ────────────────────────────────────────────────
 //
 // Raising 140 to 400 fixes this string and leaves the defect. Vendor messages put the STATUS at the
-// front and the DISCRIMINATOR at the back — "…are not allowed", "…exceeds the maximum allowed (1000)",
-// "…Maximum number of results is 30000." A head-only clip is therefore biased against exactly the part
+// front and the DISCRIMINATOR at the back — the operator that is not allowed, the bound that was
+// exceeded, the maximum that was passed. A head-only clip is therefore biased against exactly the part
 // a classifier needs, at whatever length it is set to. The bias is the bug; the number is not.
 //
 // So: keep the head, keep the tail, elide the middle. The head carries the HTTP status and the office

package/providers/_shared/screen.mjs

@@ -9,8 +9,8 @@
 
 export const BATCH_SCREEN_CHUNK = 100; // corsearch brand-json page size; clarivate /text caps at exactly 100 too.
 
-// Live/dead status map for brand-json's vocabulary (HAR-counted across 702 rows: Valid 337, Invalid 187,
-// Pending 103, Expired 69, GracePeriod 4, Unknown 2). FAIL-OPEN: only Invalid/Expired are confidently dead;
+// Live/dead status map for brand-json's vocabulary, counted across a screening sample so that every token
+// the endpoint uses is mapped and none is left to chance. FAIL-OPEN: only Invalid/Expired are confidently dead;
 // Valid/Pending/GracePeriod are LIVE (Pending = a live in-progress application; GracePeriod = the post-expiry
 // renewal window — both real senior-rights risks that must NEVER be batch-dropped); anything else (Unknown or
 // an unrecognized token) is AMBIGUOUS → the skill must fall through to record_fetch, never auto-drop on it.

package/providers/_shared/script-form.mjs

@@ -16,9 +16,9 @@
 // hand-written check. That is what `capabilities.nativeScriptIndex` is:
 //
 //   true   — the index holds the CHARACTERS. A native-script term is a legitimate, productive query
-//            and must be sent (the table in driver/jx.mjs): 小米 = 553,
-//            华威豹 = 6, 스타벅스 = 15 on such a provider, against 0/0/0 on a romanisation index; and
-//            archived executed bands returned non-zero on native characters across Han, Katakana,
+//            and must be sent (the comparison in driver/jx.mjs): native-script terms answer on such a
+//            provider and answer nothing on a romanisation index; and
+//            archived executed bands returned records on native characters across Han, Katakana,
 //            Cyrillic and Greek. Guarding it here would convert evidenced coverage into deferrals —
 //            the OPPOSITE defect, and a worse one, because a deferral is at least visible.
 //   false  — the index holds only the TRANSLITERATION. Sending the characters is a silent zero.

package/providers/_shared/territory-codes.mjs

@@ -6,8 +6,8 @@
 // territories by display name ("United States", "European Union" — driver/compose-read.mjs
 // PROMPT_TERRITORIES, mirroring portal-ui composerLevers), and those names flowed verbatim into
 // `region:` clauses because corsearch's offices.translate is an ISO passthrough that ASSUMES codes.
-// Corsearch answers an unknown multi-word region value with HTTP 500 — not a 400 — so auto-recovery
-// classified the failure transient and burned its park budget re-sending the same malformed query.
+// That provider answers an unknown multi-word region value as a server error rather than a bad request,
+// so auto-recovery classified the failure transient and burned its park budget re-sending it.
 // The run died at fan-in with terminalKind:repeat-signature.
 //
 // The register wire vocabulary is CODES (providers/corsearch/src/index.js: "UPPERCASE 2-letter
@@ -98,6 +98,26 @@ export const TERRITORY_TO_CODE = Object.freeze({
 // two Benelux members — and they must not depend on which internationalisation data a customer's
 // runtime happens to carry. What is derived is a WIDENING: it can only add names that would otherwise
 // have resolved to nothing, and a build whose data is thinner loses names it never promised.
+// A WITHDRAWN CODE ANSWERS TO THE SAME NAME AND IS REACHED FIRST. The runtime still knows the codes ISO
+// has retired, and it gives them the CURRENT country's name: `VD` (North Vietnam, withdrawn 1977) and
+// `VN` both answer "Vietnam". The scan runs AA to ZZ, so the dead code claims the name and the live one
+// finds it taken — seven territories resolved that way, Vietnam, Yemen, Serbia, Zimbabwe, Vanuatu,
+// Myanmar and Curaçao. None of them is a name this engine holds a jurisdiction for, so a requester who
+// wrote "Vietnam" was pointed at a code no register can answer, and one who wrote "Vietnam" AND "VN" had
+// two countries and was refused a search they had described correctly.
+//
+// Asking the runtime to canonicalise the region fixes all seven from the runtime's own data rather than
+// from a hand-written list of retirements that would go stale the next time ISO withdraws one. A code
+// that is current canonicalises to itself, so this is inert for every other entry — measured over the
+// whole AA-ZZ scan, the only entries that move are those seven.
+//
+// It does not touch the direct-code branch in normalizeTerritory, where UK deliberately stays UK: that
+// is an alias the providers own, not a withdrawal, and canonicalising there would take the decision
+// away from the translate step that is supposed to make it.
+const canonicalRegion = (code) => {
+  try { return new Intl.Locale(`und-${code}`).region || code; } catch { return code; }
+};
+
 const DERIVED_NAME_TO_CODE = (() => {
   const out = Object.create(null);
   let names;
@@ -109,7 +129,7 @@ const DERIVED_NAME_TO_CODE = (() => {
       try { name = names.of(code); } catch { continue; }
       if (!name || name === code || /^unknown/i.test(name)) continue;
       const key = strip(name);
-      if (key && !(key in TERRITORY_TO_CODE) && !(key in out)) out[key] = code;
+      if (key && !(key in TERRITORY_TO_CODE) && !(key in out)) out[key] = canonicalRegion(code);
     }
   }
   return out;

package/providers/clarivate/README.md

@@ -57,4 +57,4 @@ canonical schema, and the header names the traps — `EU` vs `EM`, `CONTAINS` on
 hard 400, and `cardinalityRefusal`, the third way this provider says "that would match too much". Then
 `src/core.js` for how those declarations are built into requests. The model-facing operator vocabulary
 lives in
-[`../../driver/skills/prelim-register/providers/clarivate.md`](../../driver/skills/prelim-register/providers/clarivate.md).
+[`../../driver/skills/clearance-register/providers/clarivate.md`](../../driver/skills/clearance-register/providers/clarivate.md).

package/providers/clarivate/src/capabilities.js

@@ -6,9 +6,9 @@
 //
 // This contract is what the plan compiler reads, and the core implements exactly what is declared here:
 //
-//   * classFilter is "native", NOT "fanout". INT_CLASS_NUMBER value "9 OR 28 OR 41 OR 42" = 18, byte-for-
-//     byte the deduplicated result of the old per-class fan-out. The fan-out is DELETED (phase 4): N
-//     classes now cost ONE call.
+//   * classFilter is "native", NOT "fanout". An INT_CLASS_NUMBER value of "9 OR 28 OR 41 OR 42" answers
+//     byte-for-byte the deduplicated result of the old per-class fan-out. The fan-out is DELETED
+//     (phase 4): N classes now cost ONE call.
 //   * predicates.default is a TRUE contains, expressed as an INFIX TERM WILDCARD (`*TERM*`) on
 //     WORD_MARK_SPECIFICATION — NOT the bare EQUALS the old MATCH_MODE_TO_FIELD.default emitted (which
 //     lost recall), and NOT the CONTAINS operator (supported on the mark field, but see the owner note).
@@ -105,12 +105,12 @@ export const CAPABILITIES = Object.freeze({
   // Stage 0.5 uses it on NEITHER, so the number means the same thing on every deployment. See the
   // matching note in providers/corsearch/src/capabilities.js and driver/register-count.mjs.
   countStatusFilter: "live",
-  // JSON body, not a URI: the bound is the parser's document-nesting cap. 80/200/500 terms all HTTP 200;
-  // 1000 → HTTP 500 "Document nesting depth (1001) exceeds the maximum allowed (1000)". Safe chunk = 500.
+  // JSON body, not a URI: the bound is the parser's own document-nesting cap, which the vendor names in
+  // the refusal it answers a stack wider than this with. Not a URI length, so widening is not the fix.
   maxOrWidth: 500,
   // ONE call: INT_CLASS_NUMBER value "9 OR 28 OR 41 OR 42" (or "9,28,41,42") = the deduplicated union.
   classFilter: "native",
-  // POST /text, EXACTLY 100 ids per call (101+ → HTTP 400), and the call is BILLED — screening an
+  // POST /text, EXACTLY 100 ids per call — a longer list is refused — and the call is BILLED: screening an
   // enumerated band also fully hydrates it. (test:true is obfuscated + unbilled + NOT persisted to the
   // record ledger: dev only, it can never back a real finding.)
   screenSource: "billed-record-fetch",
@@ -127,8 +127,8 @@ export const CAPABILITIES = Object.freeze({
   // Semantically it is the SAME CONDITION as `resultCeiling` — this query would match too much — and the
   // engine already knows what to do with that: record a count+sample descriptor and hand it to judgment.
   // It arrives as a 500 on the COUNT PROBE instead of a 400 on the search, so it landed in the generic
-  // provider-error arm and became a hard coverage hole: 7 of 161 slices on one delivered run, all
-  // `incumbent-class`, every one of them an owner or owner×term slice against a very large portfolio.
+  // provider-error arm and became a hard coverage hole — a small but real share of one delivery's slices,
+  // every one of them an owner or owner×term slice against a very large portfolio.
   //
   // AND THE EXISTING WIDTH DEFENCE CANNOT HELP, which is why nobody noticed the gap. `maxOrWidth`
   // chunks against NESTING DEPTH. Splitting a wide OR-stack into narrower ones does nothing about
@@ -152,9 +152,9 @@ export const CAPABILITIES = Object.freeze({
     // compiled to an ADJ chain — `*CORAL ADJ PUP*` — which is an ordered phrase match.
     exact:          "EXACT_WORD_MARK_SPECIFICATION",           // case-insensitive but PUNCTUATION-SENSITIVE → strip punctuation client-side
     default:        "WORD_MARK_SPECIFICATION:*TERM*",          // a TRUE contains via the term wildcard, not the recall-losing bare EQUALS
-    wildcardPrefix: "WORD_MARK_SPECIFICATION:TERM*",           // native `*` in the value (NIK* = 128)
-    wildcardSuffix: "WORD_MARK_SPECIFICATION:*TERM",           // (*NIKE = 36)
-    wildcardInfix:  "WORD_MARK_SPECIFICATION:*TERM*",          // (*NIK* = 806)
+    wildcardPrefix: "WORD_MARK_SPECIFICATION:TERM*",           // native `*` in the value
+    wildcardSuffix: "WORD_MARK_SPECIFICATION:*TERM",
+    wildcardInfix:  "WORD_MARK_SPECIFICATION:*TERM*",          // the widest of the three
     phonetic:       "PHONETIC_WORD_MARK_SPECIFICATION",
     owner:          "APPLICANT_NAME",                          // EQUALS (+ wildcards); CONTAINS is a hard 400 — never emit it
   }),
@@ -231,7 +231,7 @@ export const CAPABILITIES = Object.freeze({
   //
   // The entry-level RESCUE is the other half and it comes first: substituteRomanizedNames swaps the
   // plan entry's `romanizedTerms` in (and relaxes the predicate to contains, because `exact` on a
-  // transliteration is itself a silent zero — GR "POLITIKI PROSTASIA" exact 0 / contains 10). A slice
+  // transliteration is itself a silent zero, where the same term under contains answers). A slice
   // rescued that way is answerable and is never refused; only a native term with no romanisation defers.
   nativeScriptIndex: false,
   // No phoneme expansion knob: PHONETIC_WORD_MARK_SPECIFICATION is the whole surface; the client cannot

package/providers/clarivate/src/core.js

@@ -120,7 +120,7 @@ export const OWNER_FIELD = "APPLICANT_NAME";
 /**
  * match_mode → { name, operator, pre, post, … }.
  *
- * `default` is a TRUE contains (`*term*`, probe: *NIK* = 806) — the old EQUALS mapping silently lost
+ * `default` is a TRUE contains (`*term*`) — the old EQUALS mapping silently lost
  * recall and is gone. `exact` strips punctuation client-side (the EXACT field is case-insensitive but
  * punctuation-SENSITIVE). `wildcard` passes the caller's metacharacters through untouched — no
  * BEGINS_WITH/ENDS_WITH remapping is needed because `*`/`?` are native in the value; its only
@@ -159,24 +159,23 @@ export const MATCH_MODE_TO_FIELD = Object.freeze({
 // the space is NOT is a phrase match — and a phrase operator exists, absent from the vendor's schema but
 // solid on the wire:
 //
-//   MONSTER ADJ ENERGY = 67   ENERGY ADJ MONSTER = 0     ordered adjacency == phrase-contains
-//   CORAL ADJ PUP   = 11   PUP ADJ CORAL   = 0
-//   MOUNTAIN ADJ DEW ADJ VISIONARY = 1                   chains past two tokens (that mark was READ,
-//                                                        not guessed — /search + /text, 49 texts)
-//   *MOUNTAIN ADJ DEW* OR *MONSTER ADJ ENERGY* = 157 = 90 + 67    survives an OR-stack, exact sum, and
-//   (…) OR (…) = 157 too                                 ADJ binds TIGHTER than OR — no parens needed
+//   · ordered adjacency IS phrase-contains — the tokens match in the order written, and the reversed
+//     pair matches nothing. A space cannot express that, because a space is order-blind.
+//   · it chains past two tokens, and the record that shows it was READ rather than inferred (/search
+//     for the hit, /text for the mark itself).
+//   · it survives an OR-stack, and the stack answers the exact sum of its legs — so ADJ binds TIGHTER
+//     than OR and no parentheses are needed.
 //
-// A phrase is therefore EXPRESSIBLE, so doctrine 2 says express it. Precision beats the space's AND
-// (67 ≤ 75), which matters: the AND would have quietly widened every multi-word slice.
+// A phrase is therefore EXPRESSIBLE, so doctrine 2 says express it. Precision beats the space's AND,
+// which matters: the AND would have quietly widened every multi-word slice.
 //
 // Two caveats, both recorded rather than hidden:
-//   · There is NO string anchor for a phrase. `BEGINS_WITH "DIET MOUNTAIN"` = 9 > `DIET ADJ MOUNTAIN`
-//     = 7, i.e. the operator degrades to per-token AND. So multi-word `starts_with`/`ends_with` become
+//   · There is NO string anchor for a phrase: `BEGINS_WITH` on a multi-word value degrades to per-token
+//     AND and answers WIDER than the phrase operator. So multi-word `starts_with`/`ends_with` become
 //     phrase-CONTAINS — a strict superset of what was asked. Safe in a clearance sweep, which fails by
 //     MISSING a mark and never by surfacing an extra one, but it is a widening and it is disclosed.
-//   · Punctuation is not indexed (`MOUNTAIN ADJ DEW ADJ HI-RES` == `… HI ADJ RES` == 1), so a
-//     punctuation-only token is dropped from the chain. Kept, it matches nothing and would zero the
-//     whole phrase — `TIKI ADJ & ADJ SLUSH` = 0.
+//   · Punctuation is not indexed — a hyphenated token matches as its split form — so a punctuation-only
+//     token is dropped from the chain. Kept, it matches nothing and would zero the whole phrase.
 const PHRASE_OPERATOR = "ADJ";
 // ── A TERM MUST BE ONE MARK, ON EVERY MARK-FIELD PREDICATE ────────────────────────────────────────
 // The supplemental/cross-check lanes sometimes mint a LIST or a DESCRIPTION into the term field. All
@@ -316,7 +315,7 @@ export function compilePhraseValue(term, { pre = "", post = "", dropReserved = f
 //
 // `allowReserved` is set on the PHRASE path only, where the term is tokenised and each operator word is
 // dropped with the adjacency across it widened — so "BLACK AND DECKER" goes out as
-// `*BLACK ADJ2 DECKER*` (55 hits; the register writes it "BLACK & DECKER") rather than being refused.
+// `*BLACK ADJ2 DECKER*` — the register writes such a mark with the ampersand — rather than being refused.
 // That is an EXPRESSION of the term, not a rewrite of it, and it is a SUPERSET of the literal phrase.
 // `exact` still rejects, and correctly: that field answers HTTP 400 "Use of operators (AND, NOT, ADJ,
 // NEAR) is not allowed in this field" and offers no escape at all. The owner field is not ADJ-joined,
@@ -333,23 +332,17 @@ export function stripPunctuation(term) {
 }
 
 // ── NON-LATIN MARK TERMS ARE NOT SEARCHABLE — AND THE FAILURE IS A SILENT ZERO ─────────────────────
-// Compumark indexes a non-Latin filing by its ROMANISATION, never by its characters. The record
-// carries both, and only the romanisation is a search key:
+// Compumark indexes a non-Latin filing by its ROMANISATION, never by its characters. The record carries
+// both — `markVerbalElementText` holds the characters, `markTransliteration` the romanisation — and only
+// the romanisation is a search key. The characters answer nothing; the romanisation answers records that
+// carry those very characters, so both halves are needed to see the behaviour at all.
 //
-//     markVerbalElementText "华威豹"   markTransliteration "HUA WEI BAO"
+// Universal, not a CJK-specific behaviour: every non-Latin record read across CN/TW/JP/KR/TH/GR/UA/EG/
+// IL/SA carried a populated `markTransliteration`.
 //
-// Established against records actually fetched and read, so this is not inference:
-//
-//     华威豹 → 0        HUA WEI BAO → 32   (and the 32 contain 华威豹)
-//     小米   → 0        XIAOMI      → 57632
-//
-// Universal, not a CJK-specific behaviour — non-Latin records across CN/TW/JP/KR/TH/GR/UA/EG/IL/SA
-// carried a populated markTransliteration (JP 7/7, KR 7/7, TW 12/12, TH 10/10, GR 6/6, UA 10/10,
-// EG 11/11, SA 6/6, IL 1/1, CN 12/12).
-//
-// The romanisation is also STRICTLY BETTER for clearance than a character search would be:
-// `HUA WEI BAO` returns 华威豹, 华味宝 AND 华为爆破 — three character sets, one pronunciation. Chinese
-// squatting is overwhelmingly homophone-based, and a literal character match finds one of the three.
+// The romanisation is also STRICTLY BETTER for clearance than a character search would be: one
+// romanisation returns several distinct character sets that share its pronunciation. Chinese squatting
+// is overwhelmingly homophone-based, and a literal character match finds one of them.
 //
 // So a native-script term reaching the wire is a CLIENT-SIDE REFUSAL, never a query: 0 with no error
 // is the exact false-clean this provider swap exists to prevent, and it is the shape a caller is most
@@ -415,10 +408,11 @@ export function substituteRomanizedNames(e, pp, plan) {
 //
 // Both are EXPRESSIBLE, which is why neither is a reason to drop the name (same call as the
 // apostrophe,). The shapes that work:
-//   a quoted name      literal → 400,  the quotes stripped → answers,  `?`-substituted → answers
-//   an accented name   literal → 400,  ASCII-folded → answers
-//   `COMUNICAÇÕES`                    literal → 400,  ASCII-folded → 6605
-//   `KEY COMÉRCIO`                    literal → 23,   ASCII-folded → 23   (folding never narrows)
+//   a quoted name      literal → refused,  the quotes stripped → answers,  `?`-substituted → answers
+//   an accented name   literal → refused,  ASCII-folded → answers
+//
+// Folding never NARROWS, either: a name whose accents are already absent from the index answers the same
+// either way, so the fold is safe to apply to every name rather than only the ones that fail.
 //
 // Strip rather than `?`-substitute: a bare space is an implicit AND on this field so the tokens still
 // have to co-occur, and stripping cannot produce the `??` adjacency that a substitution would when two
@@ -542,8 +536,8 @@ export function resolveOffices(regions) {
 /**
  * ONE /search (or /count) body — the SAME SearchRequest shape for both endpoints.
  *
- * Multi-class is ONE searchField whose value is the class OR-list ("9 OR 28 OR 41 OR 42"), probe-
- * verified identical (18 hits) to the deleted 4-call per-class fan-out.
+ * Multi-class is ONE searchField whose value is the class OR-list ("9 OR 28 OR 41 OR 42"), which
+ * answers the deduplicated union of the deleted 4-call per-class fan-out.
  */
 // ── THE APOSTROPHE IS NOT SEARCHABLE IN APPLICANT_NAME ────────────────────────────────────────────
 // An apostrophe is not searchable: "TRADER VIC'S", "MCDONALD'S CORPORATION" and
@@ -1150,7 +1144,7 @@ async function fetchText(apiKey, base, group, testMode, tctx) {
 // Accepts record_ids that are EITHER synthetic `/mark/<office>/<guid>` refs OR bare guids (so the
 // skill flow is identical to Corsearch: search → record_id → record_fetch(record_id)). Returns the
 // NORMALIZED records and persists each (keyed by its synthetic ref) for the driver's A1 citation gate.
-// /text takes EXACTLY 100 ids per call (101+ → HTTP 400) — chunked here, at the bound the probe pins.
+// /text takes EXACTLY 100 ids per call and refuses a longer list, so the chunking happens here.
 export async function doRecordFetch(apiKey, base, params, tctx) {
   const inputs = Array.isArray(params.record_ids) ? params.record_ids : [];
   if (inputs.length === 0) return { type: "text", text: "ERROR: clarivate_record_fetch — record_ids is required (non-empty array of refs or guids)." };
@@ -1262,10 +1256,10 @@ export async function doBatchScreen(apiKey, base, params, tctx) {
 // names with per-office trademark counts, so the owner cross-check sweeps the applicant names the
 // register actually holds instead of a guess at the entity's styling.
 //
-// THRESHOLD (a judgment call, recorded): accept confidenceScore >= 50. The probe's control returned one
-// applicant styling at 74.0/156 marks, a second at 50.0/1, then 32/31/31 — a clean break below 50. The
-// scores are the probe's; the names are not, and the fixture spells them PAKA IZHUSEDI C.V. and IZHUSEDI
-// ATQUDCGOXET LIMITED (fixtures/README.md). Over-inclusive is the SAFE direction here: a
+// THRESHOLD (a judgment call, recorded): accept confidenceScore >= 50. The control that set it showed a
+// clean break at that value — the stylings above it held the portfolio, the ones below it held almost
+// nothing — rather than a gradient a cut-off would have to be invented for. The fixture's names are
+// invented and spelled out in fixtures/README.md. Over-inclusive is the SAFE direction here: a
 // surplus applicant name adds marks a lawyer can discard, a missing one is invisible.
 // And the expansion is strictly ADDITIVE — the caller's raw term is ALWAYS swept as well, so
 // resolution can only ever gain recall, never lose it (a failed or empty resolution degrades to exactly
@@ -1389,8 +1383,8 @@ export async function expandOwnerTerms(apiKey, base, params, tctx) {
 // against the provider's own owner vocabulary at all.
 //
 // That matters because APPLICANT_NAME EQUALS is not a full-string equality: a bare space in the value
-// is an IMPLICIT AND over the tokens (a two-word owner term = 156 == that owner's
-// full `… C.V.` styling = 156, and the mark field behaves the same way). So an un-resolved owner term is usually
+// is an IMPLICIT AND over the tokens, so a two-word owner term answers exactly what that owner's full
+// legal styling answers, and the mark field behaves the same way. So an un-resolved owner term is usually
 // BROADER than the register's own styling, not narrower — which is why this went unnoticed. But an AND
 // still requires EVERY token the caller wrote to appear in the applicant string, and a manifest names
 // an owner the way the world writes it, not the way the register spells it. One token the register does

package/providers/corsearch/README.md

@@ -56,4 +56,4 @@ and discloses, and never silently degrades into a weaker search wearing the righ
 `src/core.js`, beginning at `MATCH_MODE_PREFIX`: the match mode is a prefix character on a backtick-quoted
 clause, and the contract's match-mode predicates are those keys unchanged. `predicates.owner` is the
 exception — `owner:` is a real field clause, not a match mode. The model-facing operator vocabulary is in
-[`../../driver/skills/prelim-register/providers/corsearch.md`](../../driver/skills/prelim-register/providers/corsearch.md).
+[`../../driver/skills/clearance-register/providers/corsearch.md`](../../driver/skills/clearance-register/providers/corsearch.md).

package/providers/corsearch/src/capabilities.js

@@ -66,8 +66,8 @@ export const CAPABILITIES = Object.freeze({
     // this provider's vocabulary is ISO, where the EU is `EU`. territory-codes.mjs states the rule the
     // alias follows — "provider translate owns provider-specific spelling, e.g. EU→EM on clarivate" —
     // and the binding-layer pass in register-plan.mjs names the EU register `EM` because that is the
-    // canonical office code, so without this the region clause would carry a value Corsearch answers
-    // with an HTTP 500 rather than a 400 (the copper-bastion shape: a malformed region reads as
+    // canonical office code, so without this the region clause would carry a value this provider answers
+    // as a server error rather than a bad request (the copper-bastion shape: a malformed region reads as
     // transient and burns the park budget).
     translate: (code) => {
       const c = String(code ?? "").trim().toUpperCase();
@@ -114,9 +114,9 @@ export const CAPABILITIES = Object.freeze({
   // sent — the shared executor's script-form refusal (providers/_shared/script-form.mjs) is switched
   // off by this declaration, and switching it on would convert evidenced coverage into deferrals.
   //
-  // Carried in driver/jx.mjs as the provider comparison: 小米 = 553 exact /
-  // 127414 contains, 华威豹 = 6, 스타벅스 = 15 — where the same three terms answer 0/0/0 on clarivate.
-  // Corroborated by archived executed bands, which returned non-zero hit counts on native characters
+  // Carried in driver/jx.mjs as the provider comparison: native-script terms answer here and answer
+  // nothing on a romanisation index, which is the whole of the difference between the two.
+  // Corroborated by archived executed bands, which returned records on native characters
   // across Han, Katakana, Cyrillic and Greek. Structurally corroborated too: `name` and
   // `nameTransliteration` are TWO SEPARATE fields on a row (core.js returns both), so `name:` holds the
   // mark AS FILED and the transliteration is an extra returned field, not the search key. assembleQuery

package/providers/corsearch/src/core.js

@@ -138,8 +138,8 @@ export function assembleQuery(p) {
   // Filters (each value must be backtick-quoted)
   if (Array.isArray(p.nice_classes))  for (const c of p.nice_classes) parts.push(clause("", "nice-class", c));
   if (Array.isArray(p.registries))    for (const r of p.registries)   parts.push(clause("", "registry", r));
-  // Regions go to the wire as CODES only (copper-bastion incident: Corsearch answers an unknown
-  // multi-word region value with HTTP 500 — not a 400 — so a display name here poisons every retry).
+  // Regions go to the wire as CODES only (copper-bastion incident: an unknown multi-word region value
+  // is answered as a server error rather than a bad request, so a display name here poisons every retry).
   // Known display names are translated; Worldwide drops the clause; anything else fails loudly with
   // a message the composing model can act on in-session.
   if (Array.isArray(p.regions)) for (const r of p.regions) {
@@ -427,7 +427,7 @@ export async function doExpandPhoneme(sessionKey, params, tctx) {
 // brand-json hydrates ~100 candidate URIs in ONE POST with the screening data the thin search row lacks
 // (classes/status/owner/dates/jurisdictions/image/transliteration) — but NOT goodsAndServices. It replaces
 // the per-candidate record_fetch for the SCREENING majority (status/class/owner keep-or-drop); finalists +
-// any G&S-dependent decision still deep-fetch (the skill enforces that — skills/prelim-register/unit.md).
+// any G&S-dependent decision still deep-fetch (the skill enforces that — skills/clearance-register/unit.md).
 // The tool is registered but left OUT of every agent's tools.allow until the live probe + Alex recall A/B +
 // sign-off (the GATE) — so it is inert today.